Analysis
-
max time kernel
30s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
28-02-2023 09:58
General
-
Target
d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll
-
Size
1.4MB
-
MD5
19e6817b2fa1bae0e9e7cca721549835
-
SHA1
91b66dd16e72111b478767ae0e5837988f50166b
-
SHA256
d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03
-
SHA512
998adf86dd8380b8fc3daf28328e369e06fbeb30ecdc91650880d01549c971e3cf4613e5806345672c3acd59376e65e63437f201a8bd70b17013d2a6e24c3f32
-
SSDEEP
24576:EWaBswTAEoKwlTD82CJy4VInpmVCfixrWxITZHCALkl4Njkiu2XOx2jo7dmPtzPD:+BsUAEvw435VInksQoIdHCkdG2X1oJCc
Score
10/10
Malware Config
Signatures
-
Blackmoon, KrBanker
Blackmoon also known as KrBanker is banking trojan first discovered in early 2014.
-
Detect Blackmoon payload 1 IoCs
-
Blocklisted process makes network request 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 7 IoCs
Processes
-
C:\Windows\system32\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll,#11⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exerundll32.exe C:\Users\Admin\AppData\Local\Temp\d573bfc4f8016b5762aac81d5ea2c1fbcd402d70139482fc9b3e19daf3800e03.dll,#12⤵
- Blocklisted process makes network request
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.8MB
-
Filesize
12KB